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Abstract 

Edwards curves are a particular form of elliptic curves that admit a fast, unified 
and complete addition law. Relations between Edwards curves and Montgomery 
curves have already been described. Our work takes the view of parameterizing 
elliptic curves given by their j-invariant, a problematic that arises from using curves 
with complex multiplication, for instance. We add to the catalogue the links with 
Kubert parameterizations of ^^^0(2) and Xo(4). We classify CM curves that admit 
an Edwards or Montgomery form over a finite field, and justify the use of isogenous 
curves when needed. 

1 Introduction 

An Edwards curve [TU] is a particular form of an elliptic curve that leads to fast, uni- 
fied and complete addition formulas O |3j . Using inverted Edwards coordinates yields 
the fastest formulas for adding points on such a curve [B]. One may consult f^ for 
comparisons of multiplication on a curve, as well as for many references. 
Following [7], the equation of a twisted Edwards curve is 

ax'^ + y'^ = 1 + dx^y^ (1) 

where a, d non zero elements of a field K. An Edwards curve corresponds to a = 1. 

The completeness of the addition equations occurs only when a is a square and d is 
not a square in the base field, in which case there are no rational singular points on the 
curve. We will say that an elliptic curve E can be put in twisted Edwards form if there 
is a (rational) change of variables leading to an equation of the type ([T]). We will use 
the term complete Edwards form when a is a square (including the case a = 1 of course) 
and d is not a square. 

Recognizing an Edwards curve is relatively easy [71 Theorem 3.3]. 
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Theorem llfM^is of characteristic different from 2, the curve E is hirationally equiv- 
alent to an Edwards curve if and only if E(K) has a point of order 4- 

By l5, Theorem 2.1], if IC is finite, the curve is complete if i?(]fC) has a point of order 4 
and a unique point of order 2. 

Another form of elhptic curve is the Montgomery form 

E:By'^ = x^ + Ax^ + x (2) 

with ^ / ±2, S / (see [E]). Theorem 3.2 of [7] is 

Theorem 2 // IfC has characteristic different from 2, then every curve in Montgomery 
form is hirationally equivalent to a twisted Edwards curve, the converse being true. 

In many apphcations (factoring, elhptic curve cryptography), one has the choice of 
the curve and parameterization. In other contexts, such as primality proving or the 
CM method, a curve is given via its j-invariant and it may seem interesting to find an 
appropriate parameterization starting from j. 

Since elliptic curves having a rational 2-torsion or 4-torsion point can be parameter- 
ized using modular curves, we will indicate how to relate this to Edwards or Montgomery 
forms via Kubert's equations. This will be the task of Section [21 together with more 
general properties of the 2-torsion and 4-torsion. Section [3] is interested in CM properties 
of elliptic curves, and use classical results to investigate when the discriminant of a curve 
having CM by a quadratic order is a square in the corresponding ring class field. Results 
of Section [2] and [3] are then applied in Section [Hon curves over finite fields. Moreover, 
we show how to replace a curve that does not admit a complete Edwards form by an 
isogenous curve having such a form, thus extending jTl Section 5]. 

2 Properties of the 2-torsion 
2.1 Generalities 

We collect here some properties of the 2-torsion group of an elliptic curve whose equation 
will be taken as Y'^ = F{X) = X'^ + 02^^ -|- a^X -\- ag, with coefficients in some field IK 
of characteristic 7^ 2 (see |20J). We will note ei, 62, 63 for the roots of F{X) (over some 
subfield of an algebraic closure of the base field IfC) . Remember that the discriminant of 
the curve is 

A(^) = -6406 02^ + 16 04^02^ + 288 04 06 02 - 6404^-432 06^. 

Two curves E : Y"^ = X^ + 02^^ + 04X + 06 and E' : Y"^ = X^ + a'^X"^ + a'^X + Og 
are isomorphic if and only if there exists {u, r) in with ti 7^ such that the following 
system has a solution: 

u^a^ = 02 + 3r, 

'O^a'4 = 04 + 2ro2 + 3r2, (3) 
u^q'q = 06 + ro4 + r^02 + r^, 
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the isomorphism sending E to E' via 

{x, y) ^ {u^x + r, u^y). 

The n-th division polynomial will be denoted fn{^) and we will be interested mostly 
in the properties of 

f4{X) = + 2a2 X^ + 5a4X^ + 2006^3 + (20 02 06-604^) 

+ (—4 04 ae + 8 02^06 — 2 02 04^) X + 4a4 ae 02 — 04^ — 8 ae^. 
Note that the discriminant of F{X) is A{E)/16 and that of f^iX) is -A{Ef/4:. 

2.2 Curves with at least one torsion point 

We now turn our attention towards the 2-torsion and 4-torsion of E. If E has a rational 
2-torsion point, then F{X) will have one or three roots over K. We will call these cases 
type I or type III curves. 

Let us begin with some general results on the curve E of equation = F{X) = 
{X — xo){X^ + CX + D). Elementary computations show the following list of results: 

A(^) = 16 {xl + CxQ + Df {C^ - 41?) , 
which cannot be zero since E is an elliptic curve. Furthermore 

fA{X) = 'J>2{X)n{X) (4) 

where has degree i and 

'y2{X) = X"^ -2xoX - CxQ - D, 

'?4{X) = X'^ + 2CX^ + 6DX^ + {-8xoD + 2CD + 2xo C^) X + {4D - C^)xl + D^. 
The discriminants are 

Disc(T2) = ^xl + CxQ + D)= 4D2, 
Disc(?4) = -2« {C -ADf{xl + Cxo + Df = -2^ [C^ -4Df-Dl 
Lemma 3 The polynomials ^2 and J'4 do not have a common root. 
Proof: We compute 

Resultantx(y2(^), y4(^)) = -16(xg + Cxq + Df{C^ - 4D), 
and both terms are non-zero, otherwise F would have multiple roots. □ 
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2.2.1 Curves of type I 

Such a curve has equation = F{X) = [X — xq){X'^ + CX + D) with the quadratic 
polynomial irreducible. Let us study division by 2 on E. Let P = (x, y) be a rational 
4-torsion point. Then [2]P is the 2-torsion point {xq,{)). Writing the formulas for 
multiplication by 2, we get 

-{C- xo) -2x = xo 

or X is a root of 

= {X^ -2xoX-D-xoCY = 'y2{Xf. 

Corollary 4 If E is of type I, the polynomial 'J'4 cannot have a rational root. 

Proof: Assume on the contrary that 'J'4 has a rational root z. Then z would be sent 
by multiplication by 2 on the unique rational 2-torsion abscissa xq. This would imply 
'J'xoiz) = 0, which by Lemma [3] is impossible. □ 

Proposition 5 The curve E : = {X — xo){X'^ + CX + D) of type I has two rational 
A-torsion points if and only if 2)2 is a square. 



Proof: The rational roots of the polynomial f^ are that of 7 2 by Corollary HI Writing 

^0 



z^ = Xq + Cxo + -D, the polynomial J'2 has roots x± = xq ± z. Letting y± denote the 



ordinates, we find that y^. = z'^{C + 2(xo ± z)). Since 

{C + 2{xo + z)){C + 2(xo - z)) = C^-AD 

we see that exactly one of the factors is a square, leading to two rational 4-torsion points. 

□ 

2.2.2 Curves of type III 

Suppose now E -.Y"^ = F{X) = {X - ei){X - e2){X - 63) is of type III with all a G K. 
Then 

A(E) = 2\ei - 62)2(61 - 63)2(62 " 63)^, 

and the polynomial J'4 will factor into three quadratics 

fiiX) = (X2 - 2 61 X + 61 (62 + 63) - 62 63) 

X (X^ - 2 62 X + 62(61 + 63) - 61 63) 

X (X^ - 2 63 X + 63(61 + 62) - 61 62) 

of respective discriminants 4(6i — 63)(6i — 62), 4(62 — ei)(62 — 63), 4(63 — 6i)(63 — 62). 
If A{E) is a square in K, then one or all these discriminants are squares, so that the 
corresponding factors split. Suppose 4(6i — 63)(6i — 62) = Sf. Then the two roots of 

Qei(X) =X2-26iX + 6i(62 + 63)- 62 63 

are x± = 2ei it 61 . The corresponding ordinates satisfy 

yl = 5iV4(2x± - 62 - 63). 
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2.3 Properties of 2-isogenies 

The following formulas come from the use of Velu's formulas (already given in [9]): 

Proposition 6 Assume that E : = +a2X'^ +a4X +aQ has a rational point of order 
2, noted P = (xq, 0) . Put t = 3xq + 2a2Xo + 04 and w = x^t. Then an equation of E/ (P) 
is El : = Xf + A2Xf+A4^Xi + AQ where A-i = 02, = 04 - 5t, Aq = oq- Aa2t - 7w. 
Moreover, the isogeny Ii : E ^ Ei sends {X, Y) to 

{Xi,Yi) = (x + -^,y(i * 



X-xo' V (X-xo)^ 

The typical use of the Proposition [5] is given now. It will prove essential in the isogeny 
volcano approach later on. 

Corollary 7 Let E be a type III curve. If Ei = E/ {{ei,0)) is a type I curve, then Ei 
admits a complete Edwards form. 

Proof: An equation for Ei = E /{{ei,0)) is 

Ei-.Y^ = {X - xo){X^ + CX + D) 

with 

Xo = 62 + 63-61, - 41? = 16(ei - 62)(6i - 63), Xq + Cxo + -D = (62 - 63)^. 

If 62 and 63 are rational, then D2 is a square and we are done. □ 
2.4 Montgomery parameterizations 

A Montgomery form of an elliptic curve is some equation By'^ = x^ + Ax^ + x with 
A 7^ ±2 and B 0. This shows that only curves having a rational 2-torsion point can 
be of this form. Curves having a 2-torsion points are points on the modular curve Xq{2), 
an equation of which is 

u ^ ^ 

Note also that 

,- 1728 = i^+^^)(^-«^' 



u 

An equation for an elliptic curve E of given invariant j is 



Y^ = X-' + c^X + (6) 

1728 - j 1728 - j ^ ^ 

(with c present to accommodate twists). We compute 

A{E) = 2'^3'c^- = 2^236^6 {u + l6fu 

^ ' (j- 1728)3 {u + Uf{u~sf 
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Plugging equation (0) in we find that the cubic has rational root — c(u + 16)/(n — 8). 
The quadratic factor has discriminant Di = 9c^u(u + 64) (u + 16)^. Moreover 

©2 = 2*^ X + 16)2(u - 8f{u + 64). (7) 

Let us show how we can recover a Montgomery parameterization for these curves. 
Setting X = X' - c^^, this transforms ^ into 

u-8 i^u + 6A){u- Sy 

If u + 64 = then setting X' = kX" with 

(n - 8) w 

leads to the Montgomery form 

l{Y/kf =X"^ -^-X"^ + X". 

In Section O we will express u as one of Weber's functions and investigate when n + 64 
is a square in some ring class field. 



2.5 Kubert parameterizations 

In [13] are given all parameterizations of curves over Q having prescribed torsion struc- 
ture. Of particular relevance to Edwards curves is the parameterization for curves E 
containing the torsion group Z/4Z. Letting 6 G Q such that 6^(1 + 166) 7^ 0, we get the 
parameterization 

t%b : y2 = (X - 46) (X^ + X - 46) . 

The curve £3Cfe has a unique point of order 2, (46,0,1). The division polynomial /4 
factors as 

/4(X) = X (X - 8 6) (X'^ + 2 - 24 hX'^ + 128 b'^X - 256 6^) . 

The two rational roots are: 0, which leads to two rational points (0, ±46, 1) and 86, for 
which y2 = 166^(166 + 1). Note that the j-invariant of gOC^ is: 

._ (1662 + 166 + 1)^ 
^ ~ 64(16 6 + 1) ■ 

Writing w = l/b leads to 

w {IQ + w) 
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and we see that setting u = w'^ + IGw makes j of the form and that it + 64 = + 8)^ , 
so that we get a Montgomery form in that case too. With the notations of the preceding 
Section: 

Vi = 9c^w^{w + 8)2(wj2 + 16w + 16)2(1 + 16/u'), 
D2 = 2^ X + 16w + IGfiw'^ + 16w - 8f{w + Sf. 

This shows the following 

Proposition 8 For any w ^ 0, the curve E associated to w admits a Montgomery form. 
Moreover, if 1 + 16 /w is not a square, E admits a complete Edwards form. 

Making w = \6d/{a — d) ox a = d{\ + \Q/w) yields directly 

16(a2 + Uad + d'^f 



J 



ad{a — dy 



and this is precisely the invariant of a twisted Edwards curve. 

The proof of the following is rather tedious and is preferably done using a computer 
(and Maple in our case). 

Proposition 9 Suppose E is of type I: F{X) = {X - xq){X'^ + CX + D) with the 
quadratic polynomial irreducible and Xq + Cxq + D = . Then E is isomorphic to E,%b 
with 

(1 - 46) u'^ + xo-C 

r = , 

3 

^2 = C + 2(xo±z), 
whichever sign yields a square (cf. Proposition\3^ and 

^ = C + 2{x,±z) ^ = C + 2{x,±z) ■ 

Proposition 10 The Kuhert curve £3Cfc is hirationally equivalent to the Edwards curve 
of parameter d = 166 + 1. // 166 +1 is not a square, then the curve is complete. 

Proof: If we plug these values in the transformation formulae of [5l Theorem 2.1], we 
get 

02 = 26 + 1/4,04 = b^,d = 166 + l,ri/(l - d) = 1/16 
so that the curve £IK;, is birationally equivalent to 

E' : (s/4)2 = + a2r'^ + a^r, 

which is shown in the same theorem to be birationally equivalent to + y2 = \-\-dx'^y'^. 

□ 
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3 CM curves 



In the CM method, we use ehiptic curves that are constructed given their invariant. We 
have the choice of the exphcit form of the equation to be used and it is natural to ask 
when a CM curve can be written in Edwards or Montgomery form (see p] for a possible 
use in primality proving [1]). 

3.1 Theorems over C 

Let £ have complex multiplication by an order of discriminant D = f^Dx in an 
imaginary quadratic field K = Q{\/Dk) of discriminant Dk- Such a curve can be built 
using its j-invariant that is a root of the so-called class polynomial H£){X), that generates 
the ring class field Kq = K(j(0)). The roots of Hd{X) are of the form j{a) where a is 
the root of positive imaginary part of AX^ + BX + C with {A, B,C) a reduced primitive 
quadratic form of discriminant — AAC = D = Disc(a). 

Given j{a) (in other words, any root of Hd{X)), we can use equation ([6]) for £(a) 
and look for cases where A(£(a)) is a square in Kq. These results will translate in 
equivalent properties over finite fields. It is natural for this to introduce the Weber 
function 73 satisfying 73(0)^ = ^'(0^) — 1728. We rephrase p2:, Satz (5.2)] (see also [19j) 
as: 

Theorem 11 (a) When D is odd, A(£(a)) is a square in Q{a,j{a)). 
(h) When D is even, A(£(a)) is a square in Q(j(2a)). 

Proof: (a) When D is odd ^/D^^{a) is a class invariant and we write 

(b) We use Q(73(a)) = Q(i(2a)). □ 
To understand when CM curves have rational 2-torsion points, we use some other 
Weber functions, namely f(a), fi(a) and f2(a) that satisfy 

^ (-f(a)24 + 16)3 ^ (f,(a)24 + 16)3 ^ (^,(a)24^i6)3 

•^^"^ -f(a)24 fi(a)24 f2(a)24 ' 

in other words, — f(a)2'^, fi(a)2'* and f2(a)^'* are the roots of 1^. The numbers f(a)^^, 
fi(a)^^ or f2(a)^'^ are very often class invariants, that is elements of Q(j(a)); sometimes 
they are in Q(a, j(a)). Moreover small powers of these functions are very often elements 
of Q{j{ra)) for some r = 2^", as can be seen from [18] for instance. 
To go further, we introduce the generalized Weber function 

tVNizY = irjiz/N)/v{z)r 

where rj is Dedekind's function and an integer and s some integer related to N. These 
functions are modular for r'^(A^) and give a model for X^{N) (equivalently Xo{N)). In 
particular [11] 
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Theorem 12 Let a = — 2A ^ associated to the primitive reduced quadratic 

form [A, B, C] of discriminant D = — AAC . If B^ = D mod 16 has a solution in B 
(equivalently D mod 16 G {0,1,4,9};, then Q(j(a)) C Q(rD|(a)) C Q(a, j(a)). 

From this 

Corollary 13 Let D mod 16 G {0, 1, 4, 9}. Then £(j(a)) admits a Montgomery form. 
Proof: Use the fact that the modular equation hnking j(z) and 1134(2;) is precisely 

^ _ {w'^ + 16w + 16)^ 
w (16 + w) 

which sends us back to Section [2.51 □ 



4 Properties of the 2-torsion over prime finite fields 
4.1 Splitting properties 

Part of what follows can also be found in [2T] . Let K be a prime finite field of character- 
istic p > 2. The following result is classical and taken from [22] . It will help us study the 
splitting properties of F{X) and fi{X) over a finite field. Note that F{X) and f^iX) 
have no square factor (since A(S) 7^ for E to be an elliptic curve). 

Theorem 14 Let f{X) be a squarefree polynomial of degree d and n its number of 
irreducible factors modulo p. Then 



This gives us immediately. 



Proposition 15 Let p be an odd prime. The curve E has exactly one 2-torsion point 
over Fp if and only if {—^) = 
irreducible factors of f^, one has 

{-ly 



over ¥p if and only if (—^) = — 1- In that case, and writing for the number of 

° has 



Proof: We have 

^Disc(a'4)\ /-1\ -AD\ fV2 



P / \ P / \ P J \ P 
If E has a unique 2-torsion point, then 

-4D^ 



P 

which yields the result. □ 
When a polynomial P{X) has factors of degrees di, . . ., d^ over K, we will denote 
this splitting as (di) • • • {dk). The following Proposition describes the splittings of J'2 
and J'4. 
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Proposition 16 Let E : Y"^ = F{X) = {X - xo){X'^ + CX + D) he of type I. The 
splittings of IP2 and J'4 can he found in the following tahle: 





m = +1 




) = -1 












p = 1 mod 4 
p = 3 mod 4 


(1)(1) 
(1)(1) 


(4) 
(2)(2) 


(2) 
(2) 


(2)(2) 
(4) 



Proof: Assume first that (-^) = +1. If p = 1 mod 4, [P4 should have an odd number 
of irreducible factors, leading to (4) or (1)(1)(2) but Corollary U] rules out (1)(1)(2). If 
p = 3 mod 4, then T4 should have an even number of factors or be of type (1)(3) and 
(2) (2) and only the latter one is possible. 

The proof for the case (^) = — 1 is symmetrical and we omit it. □ 

4.2 Reduction of CM curves over a finite field 

If p splits in the ring class field Kq = K(j(0)), i.e., p = {U'^ — DF^)/4, then we can 
reduce £ modulo a prime factor of p in Kg to get a curve E/¥p of cardinality p+l — U. 
This is the heart of the CM-method, which is a building block in ECPP for instance 

mm- 

Conversely, a (non supersingular) elliptic curve E/¥p has complex multiplication by 
an order in an imaginary quadratic field K. In details, if E has cardinality p + l — U, 
write Disc(7r) = U'^ — Ap = V^Dk for the discriminant of the Frobenius vr of the curve. 
We have Z[7r] C C Ok, where Ok is the ring of integers of K. Noting / for the 
conductor of the order 0, we have Disc(O) = f^DK, with f \ V. 

The volcano structure [iSj (see also [12]) describes the relationships between inclu- 
sions of orders in Ok and the structure of elliptic curves having CM by these orders. 
Rational 2-torsion points are in one-to-one correspondence with isogenies of degree 2 
(see Proposition [6] for an illustration of this). The volcano for the prime 2 has the shape 
of Figure [T] (in case (2) splits in Ok)- The crater is formed of horizontal isogenies (if 
any) and each curve on the crater has one isogeny down. Any curve strictly between the 
crater and the bottom has one isogeny up and two down. 

General properties of the volcano can be used to meet some of our needs. The 
following results justifies the idea already presented in f7\ Section 5]. 

Theorem 17 Assume E/¥p is of type III. There exists a curve E' /¥p isogenous to E 
that is of type I. Moreover, E' admits a complete Edwards form. 

Proof: The proof of Proposition [T7] comes directly from |13l Proposition 23]. It is 

enough to find a curve at the bottom of the volcano for prime 2. Letting Disc(7r) = 

U'^ — Ap = DkV^ and 2" || 1/, this curve will be at level n. 

The last part comes from Corollary [71 □ 
From a practical point of view, procedure FindDescendingPath of [12] can be used 

to do just this. Now we apply the results of Section [2j Starting from our curve E, we 
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level 




level 1 

level n—1 
== levels 



Figure 1: Isogeny volcano for the prime 2. 

build a path 

E ^ El ^ ■ ■ ■ ^ En-i E' 

with En-i of type III and E' of type I. Proposition [6] can be used to transport points if 
needed. 

Remarks. 

1. We can easily modify procedure FindDescendingPath so that we can keep track 
of the 2-torsion points we encounter, so that we obtain a root of E/ {{ei,0)) from the 
ej's, see Corollary [71 

2. If we know that E has CM by Ok, then we can simplify FindDescendingPath 
by discarding horizontal invariants using the class polynomial, so that we are left with 
just one descending path. 

Numerical examples. Consider E = + X + 2 over Fioog. We find 



i 


Ei 


2-torsion 







[1,2] 


{463, 547, 1008} 


1 


[990, 30] = 


^o/((1008,0)) 


{2,3,1004} 


2 


[950,871] 


= ^i/((3,0)) 


{265,750,1003} 


3 


[1003, 17] : 


= E2/ {{750,0)) 


{518} 



and E-^ admits (247, ±19) has rational 4-torsion points, and therefore is birationally 
equivalent to a complete Edwards curve. 

We end this section with the following count, that is easily deduced from the volcano 
structure. 

Proposition 18 The set of invariants of complete Edwards curves is formed of the j- 
invariants on the floor of the 2-volcano. If = t^ — v'^2"'Dk, where Dk is fundamental 
and V odd, there is a total o/2"~"^(2— such invariants, where {—^) denotes 

the Kronecker symbol. 
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4.3 Classifying Montgomery and Edwards curves over finite fields 

We assume throughout that E/¥p is the reduction of a curve £(a) having CM by an 
order of discriminant D so that in particular p = (C/^ — DV'^)/4:. The aim of this section 
is to prove the fohowing results. 

Theorem 19 // D is fundamental, then E does not admit a complete Edwards form. 

Theorem 20 Suppose E/¥p has CM by of discriminant D. The following Table 
summarizes the properties of the reduction of £.{a): 



D 


V 


2-torsion 


Montgomery form 


Edwards form 


D odd 


1 mod 8 




type III 


yes 


twisted, not complete 


5 mod 8 


even 


type III 


yes 


twisted, not complete 




odd 


none 






D even 


0, 4 mod 16 


even 


type III 


yes 


twisted, not complete 




odd 


type I 


yes 


complete 


8, 12 mod 16 


even 


type III 


yes/no 


twisted at best 




odd 


type I 


no 


no 



The following result is taken from [l6j (precised by Theorem II ip and starts our proof 
of Theorem [111 

Proposition 21 The quantity A{E) is a square modulo p = (C/^ — DV'^)/'i in the 
following cases: 

(a) D odd; 

(b) D even and 2 | V . 

Together with Proposition 1151 this proves part of our theorem. 

Proof: By Section 12.2.21 ^"^Y curve of type III admits rational roots for f^ {X) , but not 
always rational ordinates. 

Suppose D satisfies one of the conditions of Proposition [2TJ In that case, we see that 
E has zero or three 2-torsion points. If we prove that E admits at least one, we get three 
of them. 

If D = 1 mod 8, the ideal (2) splits in Ok and there are three (distinct) rational 
isogenies starting from E, corresponding to three 2-torsion points {[L21 Proposition 23] 
again). Then apply Corollary [131 

It is clear that when D = 5 mod 8 and V odd, then E has no rational 2-torsion points 
at all. With p = (f7^ — DV'^)/4, we must have U and V of the same parity. Having a 
2-torsion point is equivalent with U even and therefore V even. 

Suppose now D = —Am is even. Then U is even, so that E admits at least one 
2-torsion point. If V is even, A is a square, forcing the splitting (1)(1)(1). The cases 
m = 0, 3 mod 4 come from Corollary 1131 
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Dirichlet's theorem (see [51 Ch. 4]), gives us necessary arithmetical conditions on p 
to spht as (C/^ — DV'^)/4:. For an integer p, let Xiip) = (■^) aiid X8(p) = (|)- The 
generic characters of -D are defined as follows: 

• for all odd primes q dividing D; 

• if D is even: 

- Xi{p) -1(0/4. = 3 A, 7 (mod 8); 

- xsip) if I)/4 = 2 (mods); 

- Xi{p) ■ Xsip) if D/A = 6 (mod 8); 

- Xiip) and X8(p) D/A = (mod 8). 

Theorem 22 An integer p such that gcd(p,2cD) = 1 is representable by some class of 
forms in the principal genus of discriminant D if and only if all generic characters x{p) 
have value +1. 

The following finishes the proof of Theorem [T9l Suppose D = —4m, V odd and 
m mod 4 G {1, 2}. We now show that E does not admit a 4-torsion point. If m is odd, 
the equation p = {U/2f - {D/i)V^ = {U/2f + mV"^ shows that U/2 should be even 
and therefore p + 1 — U = 2 mod 4, since p = l mod 4 as X4(p) = +1- 

Let m be even. This implies U = 2 mod 4. Suppose m = 2 mod 8. Write p = 
(C//2)2 + 2V^ mod 8. Since C//2 must be odd, we get p = 1 + 2V'^ mod 8. On the other 
hand, Xiip) " Xsip) = +1) leading to p = 1 mod 8 and V even or p = 3 mod 8 and V odd. 
In the latter case, we have — C/ = 4 — 2 = 2 mod 4 and no rational 4-torsion exists. 

When m = 6 mod 8, we get 1+61^^ = ±1 mod 8, and Xsip) = +1 implies p = 1 mod 8 
and V even; or p = 7 mod 8, V odd and p + 1 — U = 2 mod 4. 

We are left with the case m = mod 4 and m = 3 mod 4, in which case D is 
not fundamental (or the order is not the principal one). Assume V odd. Again using 
isogenics, we see that only one isogeny up goes from E, so that E admits only one 
rational 2-torsion point. Now apply Corollary [T3J □ 

4.4 Using isogenous curves 

As already stated, we can use some isogeny to get an Edwards curve whenever possible 
in the same isogeny class as a given curve E. In the case Dk = 1 mod 8 and n = 1, we 
can also compute directly a curve of type I having CM by 20k, since h{4DK) = h{DK)- 

5 Conclusions 

We have shed some light on the links between different parameterizations and the Mont- 
gomery and Edwards form of an elliptic curve. Curves with CM by a principal order 
cannot be of complete Edwards form, though they may admit a Montgomery parame- 
terization. In practice, say in the course of the CM method [l], this could appear as a 
problem, but in many applications, replacing a curve by an isogenous one is no harm. 
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